Extending NSH services into the VPN L2/L3 domain

Abstract

Embodiments of the present disclosure are directed to augmenting a Network Service Header (NSH) metadata of a data packet with a virtual routing and forwarding identifier (VRF-ID) and forgoing augmenting a virtual private network (VPN) label into a multiprotocol label switched (MPLS) metadata of the data packet. A provider edge router can use the VRF-ID to identify a next hop for the data packet as a service to be applied prior to forwarding the data packet to a VPN site.

What is claimed is: 
     
       1. A method for applying network services to data traffic forwarded between virtual private network (VPN) sites, the method comprising:
 on a forwarding edge router of a transport network in communication with an origin site associated with a VPN, receiving a data packet addressed to a target site associated with the VPN; 
 determining a set of services to be applied to the data packet via a service chain, wherein the determining is a function of at least the VPN, wherein the set of services are applied in response to a Network Service Header (NSH) encapsulation of the data packet, and wherein a first of the set of services is applied within the transport network and a second of the set of services is applied outside the transport network; 
 augmenting metadata of the NSH encapsulation of the data packet with a virtual routing and forwarding identifier (VRF-ID) of a VRF instance associated with the VPN to configure the packet for forwarding to the second of the set of services from an egress edge router of the transport network, wherein the VRF-ID identifies a VRF-name and a VRF table indicating one or more services to be applied to the data packet; 
 encapsulating the data packet with the NSH encapsulation to form an encapsulated data packet; and 
 forwarding the encapsulated data packet into the transport network in accordance with the service chain. 
 
     
     
       2. The method of  claim 1 , further comprising forgoing augmentation of a VPN label into multiprotocol label switched (MPLS) metadata of the data packet. 
     
     
       3. The method according to  claim 1 , wherein the VPN sites are Level 3 VPN (L3VPN) sites. 
     
     
       4. The method according to  claim 1 , wherein determining the set of services comprises looking up the set of services to be applied in a VRF table according to at least one of the VPN, the origin site or the target site. 
     
     
       5. The method according to  claim 1 , wherein the service chain is used to apply the set of services to the data traffic addressed to more than one target site. 
     
     
       6. An apparatus comprising:
 an edge router of a transport network comprising a hardware processor, the hardware processor configured to: 
 receive a data packet addressed to a target site associated with a virtual private network (VPN); 
 determine a set of services to be applied to the data packet via a service chain, wherein the determining is as a function of at least the VPN, wherein the set of services are applied in response to Network Service Header (NSH) encapsulation of the data packet, and wherein a first of the set of services is applied within the transport network and a second of the set of services is applied outside the transport network; 
 augment metadata of the NSH encapsulation of the data packet with a virtual routing and forwarding identifier (VRF-ID) of a VRF instance associated with the VPN to configure the packet for forwarding to the second of the set of services from an egress edge router of the transport network, wherein the VRF-ID identifies a VRF-name and a VRF table indicating one or more services to be applied to the data packet; 
 encapsulate the data packet with the NSH encapsulation to form an encapsulated data packet; and 
 forward the encapsulated data packet into the transport network in accordance with the service chain. 
 
     
     
       7. The apparatus of  claim 6 , wherein the edge router is a provider edge router. 
     
     
       8. The apparatus of  claim 6 , wherein the VPN is a Level 3 VPN. 
     
     
       9. The apparatus of  claim 6 , wherein the edge router is configured to attach an MPLS label to the data packet, and the edge router is further configured to forgo augmentation of a VPN label into MPLS metadata of the data packet. 
     
     
       10. The apparatus of  claim 6 , wherein the service chain is used to apply the set of services to the data traffic addressed to more than one target site. 
     
     
       11. A method for applying network services to data traffic forwarded between virtual private network (VPN) sites, the method comprising:
 on an egress edge router of a transport network in communication with an origin site associated with a VPN, receiving a data packet addressed to a target site associated with the VPN, and to which a first service was applied to the packet via a service chain within the transport network; 
 determining a second service to be applied to the data packet via the service chain outside the transport network in response to Network Service Header (NSH) encapsulation of the data packet and based at least in part on a virtual routing and forwarding identifier (VRF-ID) of a VRF instance associated with the VPN contained in a metadata field of the NSH, wherein the determining is a function of at least one of the VPN, the origin site or the target site, and wherein the VRF-ID identifies a VRF-name and a VRF table indicating one or more services to be applied to the data packet; and 
 routing the data packet to a service function forwarder associated with the determined second service arranged outside of the transport network. 
 
     
     
       12. The method of  claim 11 , wherein the egress edge router is in communication with the target site. 
     
     
       13. The method of  claim 11 , wherein the egress edge router is positioned between the origin site and the target site. 
     
     
       14. The method of  claim 11 , further comprising routing the data packet from the service function forwarder to at least one VPN site based on a destination address. 
     
     
       15. The method of  claim 11 , wherein the VPN is a Level 3 VPN. 
     
     
       16. The method of  claim 11 , wherein the service chain is used to apply services to data traffic addressed to more than one target site. 
     
     
       17. An apparatus comprising:
 an egress edge router of a transport network in communication with an origin site associated with a virtual private network (VPN), comprising a hardware processor, the hardware processor configured to: 
 receive a data packet addressed to a target site associated with the VPN, wherein a first service was applied to the packet via a service chain within the transport network; 
 determine a second service to be applied to the data packet via the service chain according to Network Service Header (NSH) encapsulation of the data packet and based at least in part on a virtual routing and forwarding identifier (VRF-ID) of a VRF instance associated with the VPN contained in a metadata field of the NSH, wherein the determining is a function of at least one of the VPN, the origin site or the target site, and wherein the VRF-ID identifies a VRF-name and a VRF table indicating one or more services to be applied to the data packet; and 
 route the data packet to a service function forwarder associated with the determined second service arranged outside of the transport network. 
 
     
     
       18. The apparatus of  claim 17 , wherein the egress edge router is positioned between the origin site and the target site. 
     
     
       19. The apparatus of  claim 17 , wherein the egress edge router is logically positioned between the origin site and the target site. 
     
     
       20. The apparatus of  claim 17 , wherein the egress edge router is further configured to route the data packet from the service function forwarder to at least one VPN site based on a destination address. 
     
     
       21. The apparatus of  claim 17 , wherein the VPN is a Level 3 VPN. 
     
     
       22. The apparatus of  claim 17 , wherein the service chain is used to apply services to data traffic addressed to more than one target site.